CVE-2026-88994 All Bootstrap Blocks CVE debrief

Who should care

Defenders responsible for WordPress installations with the All Bootstrap Blocks plugin should assess exposure and verify the plugin version, especially for sites with contributor-level access and above. They should also consider the potential impact on their systems and prioritize verification and mitigation efforts accordingly.

Why it matters

Defenders should care about CVE-2026-88994 because it allows arbitrary local file inclusion and PHP execution in the All Bootstrap Blocks WordPress plugin, potentially leading to sensitive information disclosure and code execution. Verification of the plugin version and Lightspeed subsystem status is crucial, especially for WordPress sites with contributor-level access and above.

• Potential arbitrary local file disclosure and contents exposure
• Possible PHP execution where a local file containing PHP code can be reached
• Required verification of plugin version and Lightspeed subsystem status
• Potential impact on WordPress sites with contributor-level access and above

Technical summary

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PHP where a local file containing PHP code can be reached. Exploitation requires the plugin's Lightspeed subsystem to be enabled.

Defensive priority

Defenders should prioritize verifying the plugin version and ensuring the Lightspeed subsystem is not enabled if possible.

Recommended defensive actions

• Verify the plugin version and ensure it is up-to-date
• Disable the Lightspeed subsystem if not required
• Monitor for suspicious activity and file access attempts
• Restrict contributor-level access and above to necessary users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification, especially for WordPress sites with contributor-level access and above. Defenders should verify plugin version, Lightspeed subsystem status, and monitor for suspicious activity. The vulnerability allows arbitrary local file inclusion and PHP execution, potentially leading to sensitive information disclosure and code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.